Lazyown
Monthly
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
Remote code execution in LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 allows unauthenticated attackers to run arbitrary OS commands on the C2 server. The lazyc2.py component registers a Socket.IO input event handler with no authentication that passes attacker-supplied data.get('value') through LazyOwnShell.one_cmd into subprocess.call(command, shell=True), yielding full command execution in the C2 process. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network-reachable execution; no public exploit identified at time of analysis, though the vulnerable code path and its fix are fully disclosed in the vendor commit.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
Remote code execution in LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 allows unauthenticated attackers to run arbitrary OS commands on the C2 server. The lazyc2.py component registers a Socket.IO input event handler with no authentication that passes attacker-supplied data.get('value') through LazyOwnShell.one_cmd into subprocess.call(command, shell=True), yielding full command execution in the C2 process. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network-reachable execution; no public exploit identified at time of analysis, though the vulnerable code path and its fix are fully disclosed in the vendor commit.